* [PATCH] usb: cdns3: avoid possible null_ptr_deref in cdns3_gadget_ep_queue
@ 2024-10-25 6:43 Chen Ridong
2024-10-29 3:35 ` Greg KH
0 siblings, 1 reply; 2+ messages in thread
From: Chen Ridong @ 2024-10-25 6:43 UTC (permalink / raw)
To: peter.chen, pawell, rogerq, gregkh; +Cc: linux-usb, chenridong, wangweiyang2
From: Chen Ridong <chenridong@huawei.com>
The cdns3_gadget_ep_alloc_request functions may return NULL
when memory is out of use. To void possible null_ptr_deref,
return ENOMEM when cdns3_gadget_ep_alloc_request returns NULL.
Signed-off-by: Chen Ridong <chenridong@huawei.com>
---
drivers/usb/cdns3/cdns3-gadget.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index fd1beb10bba7..982e8e0759e8 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -2657,6 +2657,10 @@ static int cdns3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
struct cdns3_request *priv_req;
zlp_request = cdns3_gadget_ep_alloc_request(ep, GFP_ATOMIC);
+ if (!zlp_request) {
+ spin_unlock_irqrestore(&priv_dev->lock, flags);
+ return -ENOMEM;
+ }
zlp_request->buf = priv_dev->zlp_buf;
zlp_request->length = 0;
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] usb: cdns3: avoid possible null_ptr_deref in cdns3_gadget_ep_queue
2024-10-25 6:43 [PATCH] usb: cdns3: avoid possible null_ptr_deref in cdns3_gadget_ep_queue Chen Ridong
@ 2024-10-29 3:35 ` Greg KH
0 siblings, 0 replies; 2+ messages in thread
From: Greg KH @ 2024-10-29 3:35 UTC (permalink / raw)
To: Chen Ridong
Cc: peter.chen, pawell, rogerq, linux-usb, chenridong, wangweiyang2
On Fri, Oct 25, 2024 at 06:43:31AM +0000, Chen Ridong wrote:
> From: Chen Ridong <chenridong@huawei.com>
>
> The cdns3_gadget_ep_alloc_request functions may return NULL
> when memory is out of use. To void possible null_ptr_deref,
> return ENOMEM when cdns3_gadget_ep_alloc_request returns NULL.
>
> Signed-off-by: Chen Ridong <chenridong@huawei.com>
> ---
> drivers/usb/cdns3/cdns3-gadget.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
> index fd1beb10bba7..982e8e0759e8 100644
> --- a/drivers/usb/cdns3/cdns3-gadget.c
> +++ b/drivers/usb/cdns3/cdns3-gadget.c
> @@ -2657,6 +2657,10 @@ static int cdns3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
> struct cdns3_request *priv_req;
>
> zlp_request = cdns3_gadget_ep_alloc_request(ep, GFP_ATOMIC);
> + if (!zlp_request) {
> + spin_unlock_irqrestore(&priv_dev->lock, flags);
> + return -ENOMEM;
Are you sure this is ok? What about the resources that have been
allocated before this return would interrupt them? How was this tested?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-10-29 3:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-10-25 6:43 [PATCH] usb: cdns3: avoid possible null_ptr_deref in cdns3_gadget_ep_queue Chen Ridong
2024-10-29 3:35 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox